Thom Park wrote:
> Craig,
>
> can Tomcat 4 support multiple realms, i.e. more than one Realm at the same time?
Yes.
> If
> so, how would
> the application be mapped to use the appropriate realm?
>
The secret is that you can nest a <Realm> entry (in the "conf/server.xml" file) inside
a <Context>, a <Host>, or an <Engine>. The default server.xml file nests a realm at
the engine level, so it applies to all requests for any app inside any virtual host.
To make a single webapp use a different realm from the default, simply create a context
entry for it with a nested realm entry:
<Context path="/myapp" docBase="myapp">
<Realm className="..." ... other attributes ... />
</Context>
and this one webapp will use the newly configured realm -- all the other webapps (that
don't have their own custom realms defined) will use the default one.
>
> I noticed that there is a 'realm-name' entry in the login-config field. Could this
> be used to select the
> appropriate Realm manager? I understand from the spec that this is different from a
> security policy domain but,
> in all fairness, wouldn't it be useful if we could use the realm name to somehow
> constrain the authorization to a particular
> realm 'manager'?
>
It's confusing because the spec for HTTP BASIC calls this thing a "realm", and
therefore so does the servlet spec. What the <realm-name> entry does is controls the
prompt that shows up in the pop-up dialog box when you are challenged for a username
and password. You will want to ensure that you have a one-to-one correspondence
between the <realm-name> entries in web.xml, and the <Realm> entry in server.xml that
will be utilized.
>
> Currently, I'm using multiple instances of tomcat, each with a different realm
> manager defined for handling different
> user authorization needs.
>
> It's a bit klunky - Java Web Server could handle multiple realm support and I was
> wondering if this could be a potentially useful
> feature.
>
> What do you think?
>
See above.
And, as an extra bonus, there's one more feature we might as well mention here :-).
Even if you are using the same <Realm>, the default configuration of Tomcat 4.0 will
force you to authenticate yourself to each webapp individually. But, what if you
really want to make the user log on the first time they encounter a protected page in
*any* web app (within a virtual host), and then have that username be good across *all*
of them?
The answer is quite simple -- just uncomment the server.xml entry like this:
<Valve className="org.apache.catalina.authenticator.SingleSignOn"
debug="0"/>
and this will work. NOTE: This only makes sense when your <Realm> is shared across
all of the webapps, so don't put a <Realm> entry each <Context> as discussed above --
simply allow the "defaulting" mechanism to let the realm be shared.
>
> -Thom
>
Craig
>
> "Craig R. McClanahan" wrote:
>
> > David Haraburda wrote:
> >
> > > Hello,
> > >
> > > I am in the process of migrating our web application to Tomcat 3.2.
> > > Currently I am looking at re-working our current method of
> > > authentication. I noticed that in the server.xml file there is a note
> > > that says "You can plug more advanced authentication modules". Since
> > > JDBCRealm will not work for us, I am assuming I need to write my own
> > > module/Realm class. Is my assumption correct?
> >
> > You've got it. You will need to write a subclass of BaseInterceptor (for Tomcat
> > 3.2) that behaves the way you need it to, and then configure that interceptor
> > into use through server.xml.
> >
> > What I would do is start from the source for JDBCRealm and change what you need
> > to for where to look up usernames, passwords, and roles.
> >
> > > What do I need to create
> > > my Realm class? I looking for the "right way" to do this, since it
> > > looks like what we did before that worked with Tomcat 3.1, is now broken
> > > with 3.2. I want to write whatever I need to write in a manner that
> > > will be compatible for future releases of Tomcat. Sorry if I sound a
> > > bit confused -- I am :)
> > >
> >
> > In 4.0, it's different -- you will write a subclass of
> > org.apache.catalina.realm.RealmBase to do what you need. Again, you can start
> > from the existing JDBCRealm as an example.
> >
> > >
> > > Thanks for any help,
> > >
> > > David
> > >
> >
> > Craig McClanahan
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: [EMAIL PROTECTED]
> > For additional commands, email: [EMAIL PROTECTED]
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [EMAIL PROTECTED]
> For additional commands, email: [EMAIL PROTECTED]
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, email: [EMAIL PROTECTED]
